（CVE-2025-4577）Smash Balloon Social Post Feed插件存储型跨站脚本漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-4577
• https://github.com/advisories/GHSA-h8v5-mvp3-hf33
• https://cve.imfht.com/detail/CVE-2025-4577
• https://avd.aquasec.com/nvd/2025/cve-2025-4577/
• https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2025-4577
• https://afaghhosting.net/blog/cve-2025-4577-smash-balloon-social-post-feed-wordpress-stored-cross-site-scripting-vulnerability/
• https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/custom-facebook-feed
• https://solidwp.com/blog/wordpress-vulnerability-report-june-18-2025/
• https://www.nsfocus.net/vulndb/123621
• https://blog.sucuri.net/2025/06/vulnerability-patch-roundup-june-2025.html

Related Vulnerabilities

• PoCCVE-2025-6389: Sneeit WP Social WordPress Plugin - Unauthenticated RCE via call_user_func
• PoCCVE-2025-14726: WordPress Widgets for Social Photo Feed <= 1.8 - Information Disclosure
• PoCCVE-2024-30464: WPZOOM Social Icons Widget <= 4.2.15 - Missing Authorization
• PoCwordpress-simple-social-icons-fpd: WordPress Simple Social Icons - Full Path Disclosure
• PoCCVE-2024-6753: Social Auto Poster <= 5.3.14 - Stored Cross-Site Scripting
• PoCCVE-2012-4273: 2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting
• PoCCVE-2017-18500: Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scripting
• PoCCVE-2017-18501: Social Login by BestWebSoft < 0.2 - Cross-Site Scripting
• PoCCVE-2019-9978: WordPress Social Warfare <3.5.3 - Cross-Site Scripting
• PoCCVE-2021-24746: WordPress Sassy Social Share Plugin <3.3.40 - Cross-Site Scripting
• PoCCVE-2021-24956: Blog2Social < 6.8.7 - Cross-Site Scripting
• PoCCVE-2021-24987: WordPress Super Socializer <7.13.30 - Cross-Site Scripting
• PoCCVE-2021-25065: Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting